HN user
One could make a case that the use of sha256 would drive down the cost of comodity ASICs, enabling a well resourced attacker to use mining hardware 'off-label' to find sha256 hash collisions. Same goes for scrypt, with the adoption of its use as a password store.
Hardly a waste of time. You haven't seen this for what it truly is; a waste of time is your cash sitting in a clearinghouse for days before going overseas. a waste of time is any value transaction that takes more than minutes on a global scale. A waste of time is when the authorities freeze your accounts and cancel your cards. Cryptocurrency solves these problems and more.
Doesn't work that way, bitcoin proof of work uses SHA256 twice, which is of limited value. It gives you a near collision to a double hash. It's burning energy for work.
PFS doesn't provide any resistance against an active attacker; ie: one that can substitute any message between the client and server.
pFs provides resistance to previously passively recorded cipher texts being decrypted when the static secret key is disclosed. It does this by ensuring the session key exchange is protected by an ephemeral key; it is not possible to derive the session key from any static configuration, ie: rsa private key.
With the PFS ciphers, the static secret key provides server authentication; so you know your talking to the correct server or in this case FBI carnivore device. The mitm appliance can even support PFS between you and it so you wouldn't even know the difference!
Agreed, neat stuff. I installed it on my windows workstation.
Don't forget it's userspace equiv (strace is syscalls), ltrace. This tracks all lib calls made by process.
Under windows, strace is an SSL/TLS monitoring tool (also hella useful). It shows payloads passed to CryptoAPI/CNG libs so you can easily troubleshoot explicitly encrypted protocols like ldaps. Especially useful if you use client authenticated TLS where is is not possible to use a TLS mitm proxy to snoop the layer 7 data.